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==Phrack Inc.== 


Volume Two, Issue 12, Phile #1 of 11 


3/29/87 


Ok, so we made it through another few delayed weeks of saying a 
release was coming soon. But of course, I finally got motivated and got this 
issue moving. I’d like to thank many of the people who rushed themselves to 
get their articles to me when they didn’t know that the release was so soon, 
and for those that haven’t gotten their articles in in time (for two issues, 
mind you [no names mentioned, of course, but I felt a denotation would be 
sufficient to provide my feelings in the introduction]) a big, "Oh well." 
We’re glad you’ve continued your patronage (Ha!) with Phrack Inc. over the 
past year and a half or so and a big thanks to all of the writers who have 
kept the publication going for all this time. But after this issue comes a 
break. Not a break in putting Phrack out, but a break in the grind and rush 
to get it out as I did with this issue. Phrack 13 will be EXTREMELY 
different, and I guarantee that to you. Phrack 13 will be released on April 
lst (hmm...ring any bells?) so be watching for it! Later 


Taran King 
Sysop of Metal Shop Private 


This issue of Phrack Inc. includes the following: 

1 Index of Phrack 12 by Taran King (2.3 k) 

2 Pro-Phile IX on Agrajag The Prolonged by Taran King (6.7 k) 

3 Preview to Phrack 13-The Life & Times of The Executioner (4.9 k) 
4 Understanding the Digital Multiplexing System (DMS) by Control C (18.8 k) 
5 The Total Network Data System by Doom Prophet (13.2 k) 
#6 CSDC II - Hardware Requirements by The Executioner (8.1 k) 

7 Hacking : OSL Systems by Evil Jay (8.7 k) 

8 Busy Line Verification Part II by Phantom Phreaker (9.1 k) 

9 Scan Man’s Rebuttal to Phrack World News (16.5 k) 

10 Phrack World News XII Part I by Knight Lightning (13.3 k) 

11 Phrack World News XII Part II by Knight Lightning (14.7 k) 
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==Phrack Inc.== 
Volume Two, Issue 12, Phile #2 of 11 
==Phrack Pro-Phile IX== 
Written and Created by Taran King 
3/17/87 
Welcome to Phrack Pro-Phile V. Phrack Pro-Phile is created to bring 
info to you, the users, about old or highly important/controversial people. 


This month, I bring to you a name from the past... 


Agrajag The Prolonged 


Agrajag was popular on many boards and hung out with many of the 
stronger names in the phreak/hack community. 


Personal 


Handle: Agrajag 
Call him: Keith 
Past handles: None 
Handle origin: Fictional character in Hitchhiker Trilogy 
Date of Birth: 6/14/67 
Age at current date: 19 years old 
Height: 6’2" 
Weight: 139 lbs. 
Eye color: Brown 
Hair Color: Depends on the day (Orange, Brown, Black, Hot Pink, etc.) 
Computers: TRS Model III, worked his way up to a TVI 950 Dumb 
Terminal 


The Prolonged 


Agrajag started phreaking and hacking in about 1979 through the help 
of some friends of his. He originally started hacking (programming) on a 
Vector 8080 in 4th grade. His instructor then is now one of the top 5 
computer instructors. Phreaking began with, of course, codes but he was very 
interested in how the phone system worked. He had read some books on the 
phone company and their evils in their earlier days and he was very interested 
in the very idea of becoming an operator. Members of the elite world which he 
has met include Tuc, BIOC Agent 003, Broadway Hacker (negative), and Cheshire 
Catalyst, all at a Tap meeting he attended. On regular BBSes, there wer 
listings for other BBSes which turned out to eventually be phreak BBSes. Some 
of the memorable phreak boards he was on included WOPR, OSUNY, Plovernet, and 
Pirate 80. His phreaking and hacking knowledge came about with the group of 
people including Tuc, BIOC, and Karl Marx. 


Agrajag was a video game programmer for the last American owned video 
game manufacturer, Cinematronix, Inc. (of Dragon’s Lair, Space Ace, World 
Series, and Danger Zone fame, of which he helped with World Series and a big 
part of Danger Zone) which went bankrupt a bit over a month ago. 


Agrajag takes interviews for magazines (such as this) which keeps up 
his phreak/hack activity. He (and a bunch of others) were written up in a USA 
Today article as well as being interviewed by a local paper when The Cracker 
(Bill Landreth) got busted (they took pictures of the back of his head in 
front of his computer). 


Agrajag was never in any major phreak groups except for The 
Hitchhikers (Bring your towel!) which was just a group of local friends. 


Interests: Telecommunications (modeming, phreaking, hacking, 
programming), music, concerts, club hopping, and video 
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games. 


Agrajag’s Favorite Thing 


Club/Bar hopping: Tijuanna (TJ) 


Most Memorable Experiences 


Going officing. Tuc, BIOC, and he were let into a local CO and they used 
their copying machine to make copies of their manuals. They 
replaced the paper [over 2 reams] later and didn’t steal anything 
major besides the paper and a few NY Bell signs. 

Called supervisors saying that they had witnessed some trunks red-lighting and 
there would be severe problems if they didn’t contact this guy, 
Abbot Went, in San Francisco. There were about 10 supervisors in 
mass hysteria (on Thanksgiving) wondering what to do. Later, they 
called up Abbot again saying they were the White House switch and 
said some kids were fooling around. 

Breaking into his school’s computer in his senior year mid-semester. He had 
scanned it out on a school prefix and the login and password was the 
name of his school. It was a TOPS-20 system and he was well enough 
versed in TOPS-20 to know what to do. The next day, he told the 
vice-principal that he had broken into the computer and that they 
had some major security problems. They said he was bullshitting and 
he told them to read their mail. Then, later, he brought in his 
equipment and showed them with the principal there. He was 
threatened by the principal with police, etc. but he told them to go 
to hell. He was later offered a job helping the security on the 
system but instead, he told them how they could solve the security 
problem and didn’t take the job. 

Agrajag’s teacher asking him to do a credit check on someone illegally. He 
eventually did part of it, but the teacher was an asshole so he 
didn’t give all the information to him. 

Getting flown to the Tap meeting by a friend. 


Some People to Mention 


Tuc 

BIOC Agent 003 
Karl Marx 
Automatic Jack 


All for being friends and all around good people and phreaks. 


Agrajag is out and out against the idea of the destruction of data. 
He hated a person intensely because they posted private lines with 
instructions on how to maim a system owned by someone who was already hated. 
He deleted the message (he was co-sysop) and it became a bit controversial. 
He hated that then and still has no respect for anyone who does this. Where 
have all the good times gone? 


I hope you enjoyed this phile, look forward to more Phrack Pro-Philes coming 
in the near future. ...-And now for the regularly taken poll from all 
interviewees. 


Of the general population of phreaks you have met, would you consider most 
phreaks, if any, to be computer geeks? The general populus, yes, but good 
phreaks, no. Thank you for your time, Agrajag. 


Taran King 
Sysop of Metal Shop Private 
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% The Life & Times of The Executioner % 
% by Oryan QUEST % 
% Written on 3/16/87 % 


L292 FO Oo 


This file was not written with the intention of being cute, funny or to tell 
fellow phreaks and hacks how lame or stupid they are. It was written to open 
the eyes of these idiots to see what the REAL story is. 


he Executioner/Mikey 


I’m am sure the majority of you have heard of "Exy." His claim to fame is 
simply telling people how lame they are or how great and sexy he is. He also 
claims to be wealthy and that Phreak Klass 2600 is the best bulletin board on 
this side of the galaxy. Let us examine some key events. 


When Metal Shop Private was up, Mr. Sexy Exy (oh and I doubt he really is), 
proceeded to rag on everyone on the system with the exception of a few that he 
ass-kissed. He then turns around when Phreak Klass 2600 (and I am in no way 
ragging on Phreak Klass) goes up, to ask everyone he has annoyed for over 2 
months and badgers them to call. Now, Mike, I seriously doubt you are as sexy 
as you claim for several reasons. Just by the nature of your attitude, the 
way you think you are powerful because you can "tell" people about their lives 
and families when you yourself are a Chinese bastard who has an unemployed 
father that can barely speak the English language. 


"Miko ith no heeahh riiitte nao" 
(Michael is no here right now) 


You have ragged on Arthur Dent when you know that you will NEVER receive the 
admiration or stature whether it be socially or economically he has attained. 
You have ragged on Dr. Doom when he has achieved more than you can ever hope 
for. You only commenced to rag on him when he turned down your offer to join 
PhoneLine Phantoms. This is because he refused to be associated with an 
asshole like you. You continually show signs of immaturity (I am not saying I 
am perfect) by poking fun at other people’s races (blacks, spics, Iranians) 
when you yourself are nothing but a rice dick. 


You bad mouth people but, when you need their help you beg for it and ask them 
to be cool. You write stupid poems and rhymes about people when they are a 
TOTAL misrepresentation of facts. You claim Dr. Doom is so ugly he could 
never leave his room. Tell me, have you ever met Dr. Doom? Isn’t it true 
that you ragged on him only because he didn’t want anything to do with you, 
your group, and your image? 


Are you going to rag on me now and prove all the points I have brought out? I 
think so. You ragged on me, telling me my family receives government chees 
handouts and telling me what a loser I am when you yourself have never met m 
or bothered to seek the real facts. You then proceeded to badger me to join 
your new "legion of queers," The Network Technicians telling me how cool it 
would be and begging me to help you learn. But don’t I receive government 
cheese handouts? Aren’t I such a loser? Mr. Solid State trusted you and 
joined PLP. He thought nothing bad of you at the time. He just considered 
all the rumors about you to be false or misrepresentation. When PLP dissolved, 
he saw no purpose to be in any longer and dropped out. You proceeded to rag 
on him, when you know you aren’t half the man he is. You don’t even possess 
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half the knowledge or personality he has. Tell me, what gives you such 
authority to rag on people? What makes you so supreme? Why are you so rich, 
when you are 18 and don’t even have a car, when you go on and on about your 
parents? 


You rag on Atlantis because you were kicked off. Now you tell people how lame 
it is and how stupid The Lineman and Sir William are. When you know that they 
were sick of your, "I am supreme attitude," of your childish antics and your 
lack of knowledge of any kind. 


Well, Exy, rag on me now, tell me how lame I am, insult me. Make your poems, 
songs, and raps. Tell me what kind of a loser I am. Insult Solid State, show 
us just how childish you can be. Until then, go back into your dream world 
and leave us alone. 


Oryan QUEST 
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<B><BE><E><3><S><P><h><a><n><t><a><Ss><i><e><B><E><3><S><S> 


<S> A Tribunal Communications Ltd. (c) 1987 <S> 
<h> <p> 
<a>Understanding the Digital Multiplexing System (DMS) <a> 
<d> Part 1 <w> 
<o> By Control C <n> 


<w><%3><%3><3><%3><%><R><e><a><1l><m><%><><3><E><E><S><B><!> 


The DMS switching system, is a lot smaller than normal systems. It takes up 
less than 16% of the space for the same number of Step-By-Step (SXS) lines and 
20% of cross bar. This is done by taking the hardware out of the CO and 
putting them closer to a group of subscribers. Then central office services 
can be provided over shorter loops. 


DMS offers remote switching with a bunch of remote modules in a bunch of 
sizes and capabilities. Some include SXS replacement or growth, Outside plant 
cable relief, and Office feature’s. The use of remote modules give the CO 
more floor space that would usually be used by the Line Concentrating Modules 
(LCMs), Main Distribution Frame (MDF), and cable equipment. The advantage of 
these modules is that it extends the service radius of the CO, this means 
outside plant savings. Remote modules can be located up to 150 miles away 
without messing up transmissions. 


Other advantages of the DMS system are that it allows integration between 
Transmission facilities and switching systems. It’s hardware & software is 
designed to give a full range of switching applications for Private Branch 
Exchange (PBX) business systems, local, toll, and local/toll requirements. The 
same Central Control Complex (CCC) and switching networks are used throughout 
the whole system. The only difference between each system is the peripheral 
units, and software packages. It has a Maintenance and Administration Position 
(MAP) which is a integrated multifunction machine interface that switch 
maintenance, line and trunk network management, and service order changes can 
be carried out. 


The software for the central processor is written in PROTEL, a high level 
pascal based language. Peripheral processors use a XMS-Pascal software 
language. 


DMS has a high line and trunk capacity. It has up to 100,000 lines ona 
DMS-100 or 60,000 trunks on a DMS-200. It also gives up to 1.4 million 
two-way CCS through the switching network. The processor can accept up to 
350,000 call attempts. 


Here’s a list of the DMS systems in use today: 


DMS-100 - is a class 5 local office with the ability to handle 1,000 to 
100,000 lines. It can give basic telephone service or expanded to handle IBN 
custom calling features. The DMS-100 MTX gives cellular radio services. A 
local office can also be adapted to Equal Access End Office (EAEO). 


Remote Switching Center (RSC) - Ability to handle up to 5,760 lines. 
Remote Line Concentrating Module (RLCM) - Ability to handle up to 640 lines. 
It uses host Line Concentrator Module (LCM) that can be used by the RSC or 


directly by the host DMS-100. 


Outside Plant Module (OPM) - Ability to handle up to 640 lines. This also can 
be used by the RSC or directly by the host DMS-100. 


Subscriber Carrier Module (SCM-100) There are thr basic types of 
SCM-100’s: 
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1- Subscriber Carrier Module Rural (SCM-100R) - This eliminates the central 
office Central Control Terminal (CCT) by integrating directly into the 
DMS-100 through the DMS-1 span lines. 

2- Subscriber Carrier Module SLC-96 (SCM-100S) - This gives a direct 
interface between DMS-100 and AT&T’s SLC-96 digital loop carrier 
systems. 

3- Subscriber Carrier Module Urban (SCM-100U) - It’s used as an interface 
to the DMS-1 Urban. The DMS-1 urban is a digital subscriber carrier 
system modified for use in Urban areas. It gives Plan Ordinary 
Telephone Service (POTS) and special services between a central office 
and residential and business communities. It has the ability to handle 
576 lines of POTS and special services. 


DMS-200 - Has the ability to handle from a few hundred to 60,000 trunks. This 
switch can also serve a Access Tandem (AT) function. The Traffic Operator 
Position System (TOPS) puts operator services into the DMS-200. Operator 
Centralization (OC) allows a single operator location by using the TOPS 
positions to transfer operator services from other DMS-200 toll centers. The 
Auxiliary Operator Services System (AOSS) let operator services on calls that 
need outside information (Such as Directory assistance). 


DMS-100/200 - Allows local and toll features described above but also includes 
a Equal Access End Office (EAEO)/Access Tandem (AT) combination. It has the 
ability to handle up to 100,000 lines or 60,000 trunks. 


DMS-250 - This is a high capacity toll system for specialized common carriers 
needing tandem switching operations. 


DMS-300 - This is a toll system designed for international use. To my 
knowledge there are only two DMS-300 switches in use at this time. 


DMS switches are divided into four "Functional" areas designed to do certain 
operations. These areas ar 


1- Central Control Complex (CCC) 

2- Network (NET) 

3- Peripheral Modules (PM) 

4— Maintenance and Administration (MAP) 


Here’s a description of those areas. 
Central Control Complex 


Within the Central Control Complex (CCC), the main program in the switch 
controls the processing of calls, maintenance and administrative routines, and 
changes the activity for these routines to other areas of the switch. The CCC 
sends messages to the network, the maintenance and administrative areas trough 
message links and directs the functions to be run in those areas. 


Network 


The Network Modules (NMs) handle the routing of speech paths between the 
Peripheral Modules (PMs) and keep these speech connections for the rest of the 
call. The network handles message and speech links between the PMs and the 
CCE. 


Maintenance and Administration 


Within the Maintenance and Administration includes Input/Output Controllers 
(I0Cs) - IO0Cs interface local or remote input/output devices. The I/O devices 
are used to do testing, maintenance, or administrative functions for the 
system. 


Peripheral Modules 


Peripheral Modules (PMs) are used as interfaces between digital carrier spans 
(DS-1), analog trunks, and subscriber lines. The PMs are used for scanning 
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lines for changes of circuit state, doing timing functions used for call 
processing, creating dial tones, sending, receiving signaling, and controlling 
information to and from the CCC, and checking the network. 


Before 1984 only four types of PMs gave trunk interfaces to the DMS system; 
these include Trunk Modules (TMs), Digital Carrier Modules (DCMs), Line 
Modules (LMs), and Remote Line Modules (RLMs). Since then ten more have been 
added, these include Digital Trunk Controller (DTC), Line Group Controller 
(LGC), Line Trunk Controller (LTC), Line Concentrating Module (LCM), Remote 
Switching Center (RSC), Remote Line Concentrating Module (RLCM), Outside Plant 
Module (OPM), Subscriber Carrier Module Rural (SCM-100R), Subscriber Carrier 
Module SLC-96 (SCM-100S), and Subscriber Carrier Module Urban (SCM-100U). 


Here’s and explanation of those modules: 


Trunk Module 


he Trunk Module (TM) changes incoming speech into digital format, it has the 
ability to handle 30 analog trunks. The Pulse Code Modulation (PCM) 
information is combined with the trunks supervisory and control signals then 
transmitted at 2.56 Mb/s over speech links to the network. 


The TM also uses service circuits such as Multifrequency (MF) receivers, 
announcement trunks, and test circuits. Each TM has the ability to interface 
30 analog trunks or service circuits to the network over one 32-channel speech 
link. The TM is not traffic sensitive so each trunk can carry 36 CCS. 


Digital Carrier Module 


The Digital Carrier Module (DCM) gives a digital interface between the DMS 
switch and the DS-1 digital carrier. The DS-1 signal consists of 24 voice 
channels. The DCM takes out and puts in signaling and control information on 
the DS-1 bit streams which then makes them DS-30 32-channel speech links. The 
DCM can interface five DS-1 lines; 5*24=120 voice channels; into four 32- 
channel speech links. The DCM can carry a maximum of 36 CCS of traffic on 
each trunk. 


Line Module 


The Line Module (LM) gives an interface for a maximum of 640 analog lines and 
condenses the voice and signaling into two, three, or four DS-30, 32-channel 
speech links. Four speech links have the ability to handle 3,700 Average Busy 
Season Busy Hour (ABSBH) CCS per LM. 


Remote Line Module 


The Remote Line Module (RLM) is a LM operating in a remote location from the 
DMS host. The RLMs can be located up to 150 miles from the host office, 
depending on the transmission facilities. 


Digital Trunk Controller 


The Digital Trunk Controller (DTC) has the ability to interface 20 DS-1 lines. 
Then the DS-1 lines are linked to the network by a maximum of 16 DS-30 speech 
links; each trunk is able to handle 36 CCS. 


Line Group Controller 


The Line Group Controller (LGC) dose medium level processing tasks, with the 
ability to use host and remote subscriber line interfaces. The LGC has the 
ability to use Line Concentrating Modules (LCMs), Remote Switching Centers 
(RSCs), Remote Line Concentrating Modules (RLCMs), and Outside Plant Modules 
(OPMs) . 


The LGC can interface up to 20 DS-30 speech links from the LCMs or up to 20 
DS-1 links with the ability to serve RSCs, RLCMs, or OPMs. 


Line Trunk Controller 
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The Line Trunk Controller (LTC) combines the DTC and LGC functions and gives a 
way to use all the equipment inside the office. The LTC has the ability to 
handle the LCM, RSC, RLCM, OPM, and digital trunk interfaces. 


The LTC has the ability to give interfaces to a maximum of 20 outside ports 
from DS-30A speech links or DS-1 links to 16 network side DS-30 speech links. 


Line Concentrating Module 


The Line Concentration Module (LCM) when used with the LGC or LTC is just an 
expanded version of the line Module. It can serve up to 640 subscriber lines 
interfaced with two to six DS-30A speech links. Using six speech links 5,390 
CCS can be handled per LCM. 


Remote Switching Center 


+ 


he Remote Switching Center (RSC) interfaces subscriber lines at a remote 
location to a DMS-100 host. It has the ability to handle interface for 5,760 
lines and is used a replacements for dial offices or Private Branch Exchanges 
(PBXs). It can handle 16,200 CCS with the use of 16 DS-1 links. 


a 
Fy 


he RSC consists of the following: 


Line Concentrator Module (LCM) - These modules do line interface function. 
They are the same as the LCMs that are used in the DMS-100 host. 


Remote Cluster Controller (RCC) - This controller gives DS-1/LCM interface, 
.xocal switching inside the remote, and Local intelligence and signaling when 
in ESA. 


Remote Trunking - Handles the use of RSC originating or terminating traffic 
for digital trunking off the RSC. It can give trunking to a CDO co-located 
with the RSC or within the service range of the RSC, Private Automatic Branch 
Exchanges (PABXs), or Direct Inward Dialing (DID) trunks. 


Remote-off—-Remot Lets the RLCMs and OPMs connect to the RCC through DS-1 
interfaces. It lets RLCM and OPM subscribers to use the same lines to the host 
as the RSC subscribers. 


Emergency Stand-Alone (ESA) - If communication with the DMS-100 is lost this 
will allow you to call internal to the RSC. It will give station-to-station 
and station-to-trunk calls for POTS, IBN, and electronic business sets. 


Remote Line Concentrating Module 


The Remote Line Concentrating Module (RLCM) is just a LCM used is a remote 
location from the DMS-100 host. The RLCM can handle 640 lines; this can is 
sometimes used as a replacement for CDOs or PBXs. 


Outside Plant Module 


The Outside Plant Module (OPM) is an outside plant remote unit. The OPM can 
handle 640 lines over six DS-1 links. 


Subscriber Carrier Module 


The Subscriber Carrier Module (SCM) gives a direct interface for remote 
concentrators. 


SCM-100R - It can interface up to five Northern Telecom DMS-1 Rural Remote 
Terminals (RTs). A DMS-1 rural remote terminal can interface up to 256 lines. 
Communication between the RT and SCM- 100R is done through one or two span 
lines for voice and one protection line. 


SCM-100U - It can interface up to three DMS-1 Urban RTs. A DMS-1 Urban can 
interface up to 576 POTS or special service lines. Communication from the RT 
to the SCM-100U us done through a maximum of eight DS-1 links. 
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SCM-100S - It can interface up to four Mode I (non-concentrated) SLC-96 
systems or up to six Mode II (concentrated) systems. A SLC-96 can give 
interface for up to 96 lines. 

The SCM-100 takes away the need for central concentrating terminals and analog 
line circuits at the host. 


Operator Features 


With the use of DMS-200 or DMS 100/200 switch, operator features are available 
by the following: 


Traffic Operator Position System (TOPS) 
Operator Centralization (OC) 
Auxiliary Operator Service System (AOSS) 


Traffic Operator Position System (TOPS) gives many operator function on inward 
and outward calls. The TOPS integrates the operator system with the DMS-200 
or DMS-100/200 toll switch. 


One voice and one data circuit are needed for each operator position. The 
voice circuit is connected to a port of a three-port conference circuit. The 
other two ports are connected to the calling and called parties. The data 
circuit is used for a digital modem and is used to transmit data punched in by 
the operator to the CCC for processing. 


Operator Centralization 


Operator Centralization (OC) lets the operator use the services given by the 
DMS-200 or DMS-100/200 with TOPS. With OC operator traffic from surrounding 
DMS sites can be routed to a central host site. 


Operator Centralization Diagram 
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Auxiliary Operator Services System 


The Auxiliary Operator Services System (AOSS) is made to handle directory 
assistance, intercept, and that type of operator services, automatic call 
distribution, call processing, call detail recording, and operator 
administration functions for other operator services that do not need call 
completion to a called party. AOSS position uses the same hardware as the 
TOPS links to the switch. 


Equal Access 


Equal Access (EA) is accessible through DMS switches with the addition of 
software packages. Both Equal Access End Office (EAEO) for the DMS-100 and 
Access Tandem (AT) for the DMS-200 provide equal access features. 


Equal Access Network Application 


(Phone) | DMS-100 | 
Step past | | 
NON-EAEO | | IC/INC 
SSeS SS 0 —C«C*SCéié SSS /---------\ TO 
(Phone) --- | | | DMS-200 | ---- IC/INC 
ee \ / | > 
| | 
SSeS STS | | 
(Phone) | DMS-100 | 


DMS-100 EAEO 


A 


The DMS-100 EAEO gives direct access to interLATA (Local Access and Transport 
Area) carriers Point of Presence (POP) inside the LATA. The DMS-200 AT gives 
a traffic concentration and distribution function for interLATA traffic 
originating or terminating inside a LATA. It allows the following: 


10XXX and 950-1XxXxX dialing 
presubscription dialing 
equal access and normal network control signaling 
Automatic Number Identification (ANI) on all calls 
custom calling services 


Common Channel Interoffice Signaling 


Common Channel Interoffice Signaling (CCIS) uses a separate data link to 
transmit signaling messages between offices for many trunks and trunk groups. 
There are two types of CCIS available in the DMS-200 or DMS-100/200, Banded 
Signaling (CCIS-BS) and Direct Signaling (CCIS-DS). 


CCIS-BS is for interoffice trunk signaling to give information on digits 
dialed, trunk identity, and other class and routing information. This kind of 
trunk signaling takes less time to setup calls and put’s an end to Blue 
Boxing. 


CCIS-DS is used to transfer call handling information past what is required 
for trunk setup. This type of signaling lets calling card validation, 
mechanized calling card services and billed number screening to be used. 


Cellular Mobile Radio Service 
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Cellular Mobile Radio Service is possible with the DMS-100 Mobile Telephone 
Exchange (MTX). The MTX has the ability to serve from a few hundred to over 
50,000 people in up to 50 cells. 


Thanks to Northern Telecom and my local CO. 


Control C 
ToK! 


March 1987 
End of Part 1 
<B><B><E><3><S> 
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TOTAL NETWORK DATA SYSTEM 


BY DOOM PROPH 


Gl 
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The Total Network Data System is a monitoring/analysis network used by 
several offices within the Telco to analyze various levels of switching 
systems in relation to maintenance, performance, and future network planning 
purposes. The systems and the offices that use them will be described in 
detail in the following text. 


All switching entities that are in one particular serving area collect 
traffic information that is classified in three ways: peg count, overflow, and 
usage. Peg count is a count of all calls offered on a trunk group or other 
network component during the measurement interval, which is usually one hour. 
It includes calls that are blocked, which is classified as overflow traffic. 


The other measurement types that the TNDS network analyzes and collects are as 
follows: 


Maintenance Usage (for 1ESS, 2ESS, 5XB, 1XB, XBT) 


Incoming Usage (for 1E, 2E, 4AETS) 


All trunks busy (SxS) 
Last Trunks Busy (SxS) 
Completions (SxS, 5XB, XBT, 1XB) 


Incoming Peg Count (DMS) 


Maintenance Busy Count (2E, 3E) 


Detector Group Usage (SxS, 5XB, XBT, 1XB) 


In ESS and DMS offices, traffic data is collected by the central processor of 
the switch. In electomechanical offices such as crossbar, a Traffic Usage 
Recorder is used to scan trunks and other components about every 100 seconds, 
counting how many are in use. This data when compiled is sent to the EADAS 
system, which is located in the Operating Company’s Network Data Collection 
Centers and runs on a minicomputer. 4ESS and 4Xbar toll offices do not use 
EADAS, but their own system called the Peripheral Bus Computer for traffic 
data analysis. After receiving the traffic data from up to 80 switching 
offices, EADAS performs two basic functions: It processes some data in near 
real time (shortly after it is received) to provide hourly and half hourly 
reports and a short term database for network administrators. It also collects 
and summarizes data that it will pass on to the other TNDS systems via data 
links or magnetic tape. 


Three other systems receive directly from EADAS. These systems are ICAN, 
TDAS, and EADAS/NM. ICAN stands for Individual Circuit Analysis plan and is 

used to study individual circuits in central office equipment that have been 
specified by network administrators. 


TDAS is the Traffic Data Administration System, which formats traffic data 
for use by the remaining downstream systems. ICAN and EADAS/NM are the only 
two systems with data links to EADAS that don’t have their data formatted by 
TDAS before reception. TDAS is run on a mainframe in the NDCC and can be 
thought of as a distribution facility for the traffic data. EADAS/NM is used 
to watch switching systems and trunk groups designated by network managers, 
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and reports existing or anticipated congestion on a display board at the 
Network Management Centers, where the system is located. Problems can be 
analyzed with this system and dealt with within a short period of time after 
they occur. 


Central Office Reporting Systems 


There are five TNDS engineering and administrative systems that provide 
operating company personnel with reports about CO switching equipment. These 
are the LBS, 5XBCOER, SPCSCOER, ICAN, and SONDS. LBS, the Load Balance System, 
helps assure that the customer traffic load is uniformly distributed over each 
switching system. It minimizes congestion on the concentrators, which allow 
subscribers to share th quipment in the switch. The LBS analyzes traffic 
data coming to it from TDAS to determine the traffic load on each line group 
that the system serves. LBS generates reports used by the NMC to determine 
line groups that can have new incoming subscriber lines assigned to them. LBS 
also does a load balance indexes for the entire operating company, indicating 
how effectively each CO has avoided congestion. 


Crossbar #5 Central Office Equipment Reports (5XBCOER) and Stored Program 
Control Systems COER used for 1, 2, and 3 ESS offices, analyze traffic data to 
indicate the overall service provided by the switching system and to tell how 
much of its capacity is being used. This info helps determine if new equipment 
is needed. 


ICAN, which was described briefly above, detects switching system 
equipment faults by identifying abnormal load patterns on individual circuits. 
A series of reports printed at the Network Administration Center helps network 
administrators analyze individual circuit usage and verify circuit grouping. 
ICAN is located at the BOC main computer center along with 5XBCOER. 


The fifth CO equipment reporting system is called the Small Office Network 
Data System, or SONDS. SONDS performs a full range of data manipulation 
functions, and is used to provide economically the full TNDS features for step 
by step offices. Step offices send data directly to this system, and it is not 
formatted by EADAS or TDAS, as it doesn’t go through these systems. Weekly, 
monthly, exception and on demand reports are automatically distributed by 
SONDS to the NAC personnel. 


Trunk Network Reporting Systems 


These systems are parts of the TNDS used by the Circuit Administration 
Center to support trunk servicing and forecasting. The Trunk Servicing System 
helps trunk administrators develop short term plans to make the best use of 
the trunks that are already in use. It receives and processes data received 
from TDAS and computes offered load. Offered load is the amount of traffic a 
trunk group would have carried had the number of circuits been large enough to 
handle the load without trunk blocking (giving the caller a re-order or all 
circuits busy recording). TSS produces weekly reports showing underutilization 
of trunks and below grade of service trunk groups which do not have enough 
trunks in them. The CAC uses these reports to add or disconnect trunks 
according to what traffic requirements exist. 


The Traffic Routing and Forecasting System, replacing the Trunk 
Forecasting System, forecasts message trunk requirements for the next five 
years. Major conversions and similar network changes are all taken into 
consideration when determining the future traffic needs. TRFS receives data 
from EADAS, TDAS, and TSS and is located at the Operating Company computer 
center. 


Since TDAS and some of the downstream TNDS systems need much of the same 
information, that information is maintained in a system called Common Update. 
In this manner, some data does not have to be duplicated in each individual 
system. Some of the information includes the configuration of switching 
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equipment and the trunk network and specifications on traffic registers for 
central offices. Numbers recorded by each register are treated consistently by 
each system that uses the Common Update data base. There is an update base for 
trunking, referred to as CU/TK, and an update on equipment known as CU/EQ. The 
trunking part of the Operating Company’s data base is coordinated by the Trunk 
Records Management System. 


Since the TNDS systems are so important to the proper operation of the 
network, the CSAR (Centralized System For Analysis and Reporting) is used to 
monitor the entire TNDS performance. The NDCC, the NAC, and the CAC are 
provided with measurements of the accuracy, timeliness, and completeness of 
the data flow through TNDS from beginning to end. It doesn’t analyze data from 
EADAS/NM, SONDS, or TRFS. 


BOC Operations Centers 


NAC-Network Administration Center. Responsible for optimum loading, and 
utilization of installed COE. Performs daily surveillance of COs and trunk 
groups to ensure service objectives are being met. The NAC Reviews profiles of 
office load relating to anticipated growth. They work with NSEC to initiate 
work orders to increase equipment in use. The systems they use are EADAS, 
SPCSCOER, CSAR, and SONDS. 


NMC-Network Management Centers. The NMC keeps the network operating 
efficiently when unusual traffic patterns or equipment failures would 
otherwise result in congestion. The NMC analyzes network performance and 
prepares contingency plans for peak days, telethons, and major switch 
failures. They monitor a near real time network performance data to identify 
abnormal situations. The system they use is EADAS/NM. 


CAC-Circuit Administration Center. The CAC ensures that in service trunks 
meet current as well as anticipated customer demands at acceptable levels of 
service. For planned servicing, the CAC compares current traffic loads with 
forecasted loads for the upcoming busy season. If the loads are consistent, 
the CAC issues the orders to provide the forecasted trunks. When 
inconsistencies occur, they examine the variation, develop modified forecasts, 
and issue orders based on the new forecast. They review weekly traffic data to 
identify trunk groups that need additions and issue the necessary trunk 
orders. The systems they use are TSS, TRFS, and CSAR. 


NSEC-Network Switching Engineering Center. They plan and design the 
network along with the CAC. NSEC develops a forecast of loads for traffic 
sensitive switching equipment, sets office capacities, and determines relief 
size and timing. 


For long range planning, the following offices are utilized. 


TNPC-Traffic Network Planning Center. The TNPC determines the most 
economic growth and replacement strategies. They handle future network 
considerations over a 20 year period for tandem systems, operator services 
networks, interconnecting trunks, and switching terminations to accommodate 
the trunks. 


WCPC-Wire Center Planning Center. This office does the same as the TNPC, 
but their jurisdiction includes local switches, the subscriber network, and 
interoffice facilities. They have the numbers, types, and locations of 
switches and homing arrangements. They also keep track of alternate routes, 
tandem centers, tc. Both the TNPC and WCPC provide the CAC and NSEC with 
office and network evolution plans for 20 years. 


District based maintenance and administration operations are handled by 
the NAC, RCMAC, and the SCC. These can cover 240 square miles of serving area. 
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Preface: 


This is the second part of my CSDC (Circuit Switched Digital Capability) 
series, the first being in PHRACK X. It is suggested that you read the first 
part and also the file on PACT in PHRACK XI. If I feel the material was not 
covered completely, I will make a third addition to this file. 


Hardware Interfaces 


A NCTE or equivalent network interfac quipment, located on the customer 
premises, is required to provide the CSDC feature for a customer. The NCTE or 
an equivalent circuit, located on the customer’s premises, is required to 
provide TCM (Time-Compression-Multiplexing) transmission on the 2-wire 
subscriber loop. The NCTE also has a remote loopback for testing from CSDC 
central office. 

Dedicated 2-way CSDC trunk circuits are provided via DCT (Digital Carrier 
Trunk) combined alternate data/voice (CADV) units with DCT supervision. MF and 
CCIS signalling is allowed on these trunks. They provide signalling, switching 
and trunking functions between 1A ESS switch and other CSDC offices. To 
provide CSDC, the DCT bank must be equipped with alarm and digroup control 
units. A Digital Office Timing Supply (DOTS) is needed to provide network 
synchronization for the CSDC feature. A minimum of 3 CSDC maintenance circuits 
are needed for the CSDC feature to operate. The circuit provides digital 
signals for testing CSDC trunks and loops. They also provide a test 
termination for incoming CSDC calls. If an office has superimposed ringing for 
4 and 8 party lines, these ringing circuits may be used for loop testing with 
the maintenance circuit. 


Remote Switching System 


The RSS remote frame contains eight special service slot positions that can be 
used for D4 type plug in units (basically allows the RSS to have CSDC 
abilities). This allows the CSDC TRXS (Time Compression Multiplexing Remote 
Subscriber Exchange) channel units to be housed in the RSS frame. The CSDC 
feature is provided via the RSS Tl carrier facilities. The Tl carriers for 
CSDC service terminate with position 1 and 0 at the RSS. A ringing and tone 
plant is required in the RSS office to ring the phones of special service 
channel unit subscribers. 
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Operation of the CSDC 


An off-hook origination initiates the seizure of an originating register. 
A line translation is performed and the CSDC indicator is received from the 
Line Equipment Number Class (LENCL) and is stored in the register. A touch 
tone service receiver is connected to the line and dial tone is applied. Upon 
receiving a digit, dial tone is removed. If the first digit is a ’#’, digit 
collection is set up to collect 2 more digits. Upon receipt of the 2 digits 
(99), the PACT (Prefix Access Code Translator) is indexed via the dialed 
digits to determine what service has been requested. If the line cannot have 
CSDC, an error message is sent. The AB digits (carrier selection) are 
collected next. Once the AB digits have been determined to be valid, the CCOL 
(Chart Column) is received. The CCOL merely is a code to tell the PACT what is 
to be done. Once the AB digits and the CSDC CCOL is received, the original 
register is overwritten with the CSDC CCOL. The CSDC office then sends a bit 
down the line to tell th quipment that a CSDC call is being processed. 

The call is now reinitialized to appear as though no digits have been 
collected. Digit collection proceeds until the proper number of digits (7 to 
10) has been received. An AMA register is seized at the end of the dialing. 
The call is then routed according to the dialed digits on a CSDC outgoing 
trunk. Answer guard timing for CSDC calls is 800 ms. Upon answer, the answer 
time is recorded in the AMA register. 

An outpulsing trunk is seized and a POB is hunted. If an outgoing trunk 
and outpulsing device are needed, one will be hunted. Information on the trunk 
is stored and a transfer to the outpulsing routine (MF or CCIS) is done. A 
verification insures that both calling and called parties are CSDC allowed. If 
they are not, the call is routed to an Automatic Intercept Service (AIS). 

For MF outpulsing, a junior register is seized, the outgoing trunk is put 
into the proper states, and start pulsing signal detection is done followed by 
digit outpulsing. For CCIS, call processing is the same as a normal call but a 
CCIS continuity check is performed while on the on-hook state. 

For an incoming call, the CSDC bit from the Trunk Class Code (TCC) is 
stored in the incoming register and a CSDC count is pegged. Digit collection 
is performed and a terminating DN translation is performed. Ringing is applied 
normally and once it has been answered, the incoming trunk is put in the 
off-hook state to pass answer to the next office. 

Standard disconnect and trunk guard timing is performed on CSDC calls 
when the called or calling party goes off-hook after a talking path has been 
established. 


Standard CSDC Dynamics 


Call forwarding codes dialed after the CSDC code result in reorder. 


The Call waiting option is also suspended when a CSDC call is in progress. 
Busy tone is given to POTS call that terminates to a CSDC connection. Busy 
tone is also given to a calling CSDC party if it encounters a busy line. 


In order to have a 800 CSDC feature, the office must have CCIS INWATS ability 
in the OSO (Originating Screening Office). 


Dialing 911 after the CSDC code is allowed, but 411/611 calls are routed to 
error messages. 


NCTE (Network Channel Terminating Equipment) 


eS 


As covered in Part 1, the NCTE is the equipment that you need to have CSDC. 
The NCTE is a piece of hardware that is connected to the CO loop anda 


terminal. On the terminal, there are 8 jacks for 8 pins on the NCTE. The 
functions of each pin are as followed. 


1 - TRANSMISSION DATA 
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This ends PART II of the CSDC series. Since Taran King was in such a hurry, I 
will finish the 3rd file with SCCS integrations, loop structure and RSS 
structures. 


If you have any questions about this file or any other file, please leave m 
message on either... 


Phreak KlassRoom 2600 


806-799-0016 LOGIN: EDUCATE 
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My Voice Mail Box = 214-733-5283 


7.txt Wed Apr 26 09:43:37 2017 1 


==Phrack Inc.== 


Volume Two, Issue 12, Phile #7 of 11 


INEANET NET NAINA NED NAINA ETNA 


Hacking : OSL Systems 


Written by Evil Jay 


(C) 1987/88 Evil Jay 


WA BO 
Se a BRS 


TINANTI NGI NAT NEA NEI NINA TDNGET 


Prologue: 


This file is for all those people who are running across the OSL system 
and are constantly confused about getting in and what to do once you’re in. 
Because of the trouble I had getting a manual on the system from ROLM, I 
was forced to write this file from what I already know, and what I can do 
on the few systems I have gained access to. Since this file is far from 


complete (without a manual, most are), I’1l leave it to you, to 


write up 


future files on the OSL system. Credit goes to Taran King who got me 
interested in writing the file, and who tried to help me get a manual (my 


social engineering leaves something to be desired). 


What is OSL: 


Actually it has been termed as Operating Systems Location, Off Site 


Location and a lot of other names. Which? I’m not sure. What I 


can tell 


you is that it’s an operating system running on an IBM (?) that does 
remote maintenance operations on a ROLM PBX (Referred to as CBX I 
believe). As I said, this file is not too complete, and I was unable to 
get very much information about the system, or the PBX system itself. I 
believe Celtic Phrost wrote a file on ROLM PBX systems, and you might want 


to read that or other ROLM files for more information. 


Getting In: 


If you have trouble logging in, try changing your parity. Also, this 
system will only except uppercase. The first thing you should see when you 


get a carrier is the following: 


MARAUDER10292 01/09/85(%*%G) 1 03/10/87 00:29:47 
RELEASE 8003 
OSL, PLEASE. 


MARAUDER10292 is the system identification. Most of the time, 


this will 


be the name of the company running the OSL system, but occasionally you 


will find a system, you will not be able to identify. CN/A it. 
your only chance of gaining access to that particular system. 


It might be 


01/09/85. This is a mystery to me. It could be the time that the system 
first went up (but sounds unlikely), the date of the current version of 


the OSL operating system...etc. 


The *“G is a Control-G, and rings a bell at your terminal. I do not know 


why, but it does... 
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The rest of the text on that line is the current time and date. 


RELEASE 8003 could be, again, the revision number of the software 
package. I don’t know. 


OSL PLEASE means that you can now attempt to login. 


The ? is your prompt. Remember the uppercase only. Naturally we are 
going to type "OSL" to login. Once this is done, we will receive this 
prompt: 


This is the password prompt, and so far as I can tell, can be anything 
up to, say, 20 characters long. Obviously we are going to try MARAUDERS or 
MARAUDER as a password. Here’s the tricky part. Some systems do not tell 
you whether the password was right or not. Sometimes, if it’s right, you 
will get a ? prompt again. If not, you will get an ERROR msg. It depends 
on the system. Each system is set up a different way. Also, some systems 
require all alphabetics, while others require alphanumerics and sometimes 
they will require both. Again, you may or may not get an ERROR message. 
You can ABORT anything at any time by sending a BREAK. One good thing 
about the system is that you have, so far as I can tell, unlimited 
attempts at guessing the "KEY". Also, Druidic Death says that "," is a 
default, or is commonly used (I don’t remember which). Unfortunately, I 
have never been able to get this to work myself. 


Your IN!: 


Okay, first thing we need to do is type HELP. If you have access, which 
again, differs from system to system, you will get a menu that looks like 
so. (Maybe not, but I am through telling you how strange this system is.) 


FOLLOWING COMMANDS 


E 


P — DISPLAY REPORT MENU 

- LIST REPORT COMMANDS CURRENTLY STORED 
DD AN ACD COMMAND 
ELETE AN ACD COMMAND 


A 
D 
—- MODIFY AN ACD COMMAND 
SUSPEND AN ACD COMMAND 
- ACTIVATE AN ACD COMMAND 


5 


REP: This lists a menu of reports you can view. 

LST : This lists all the commands that have been stored in the buffer. 
ACD : This activates a command. 

DEL : This deletes a command in the buffer. 

MOD : This modifies a command in the buffer. 

SUS : This suspends a command in the buffer. 

ACT : This activates a command in the buffer. 


Commands Explained: 


Okay, so now we’ll go through all of these commands and show you what they 
do, and of course, explain each example. 
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EP lists a number of reports which can be ran. Here is an example: 


REP# NAME SYNTAX 

1 -— CURRENT STATUS ACD 1, (FIRST), (LAST), (START), (INT), (#INT), (CLR), (REP) 
2 — CUMULATIVE STATUS ACD 2, (FIRST), (LAST), (START), (INT), (#INT), (CLR), (REP) 
3 -— TRUNK DISPLAY GROUP ACD 3, (FIRST), (LAST), (START), (INT), (#INT), (CLR), (REP) 
4 -—- POSITON PERFORMANCE ACD 4, (FIRST), (LAST), (START), (INT), (#INT), (CLR), (REP) 
5 -— ABBREVIATED AGENT ACD 5, (FIRST), (LAST), (START), (INT), (#INT), (CLR), (REP) 
6 — DAILY PROFILE ACD 6, (FIRST), (LAST), (START), (INT), (#INT), (CLR), (REP) 
7 — CUMULATIVE AGENT ACD 7, (FIRST), (LAST), (START), (INT), (#INT), (CLR), (REP) 

Current Status : Gives you the current status of the PBX system. 

Cumulative Status: Quite obvious. 

Trunk Display Grp: Obvious again. 

Position Prfrmnce: ??? 

Abbreviated Agent: ??? 

Daily Profile : Gives you a report of how the PBX ran on date 00/00/00. 

Cumulative Agent : ??? 

ACD: 


I purposely skipped all the other commands, since they are pretty obvious. 
They all have to do with adding commands to the buffer, modifying them and 
running them..etc. If you get access to a system, it would be wise to LST 
all of the commands that the operators have been running and then try them 
yourself. No biggy, but oh well. The ACD command activates a command and 
lists the desired report on your terminal. While the whole thing can be 
typed on one line, you can just type ACD <REPORT NUMBER> <CR> and do it 
step by step (a little easier to get the hang of it). Now we’1ll go through 
this, and show you an example of building a command to list the Trunk 
Display Report. 


D 
RL-G>FIRST GP OR AGENT ID: (Try 1) 
<CTRL-G>LAST GP OR AGENT ID: (Try 2) 
RT TIME: (Enter START TIME in army time such as 22:52:00) 


INTERVAL: (Not sure, hit return) 

# OF INTERVALS: (Not sure, hit return) 

CLEAR(Y/N): (Type Y, but this is stored in the last cleared log) 
REPEAT DAILY?: (No!) 

PRINT LAST CLEARED (Y/N): (Here’s where the last cleared shows up) 


It then prints out the command and executes it, showing you the desired 
report. 


The end result: 


Some other things can be done, such as commands like C and M and a host 

of others, but unfortunately, as I said, these systems are very strange 

and it’s hard to find two alike. The computer is not worthless, and 

lots of things can be done on it, but this file is getting quite lengthy. 
If there is enough demand, I will write a follow-up. In the meantime, if I 
have made any mistakes, or you have more knowledge that you would like to 
share with me, I can be reached on the following boards: 


ShadowSpawn Private, Hell Phrozen Over, Phantasie Realm and a few others. 


PN=TDNAT NGI NET NIN ETNGD NEI NANI NS 
\ / 
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BUSY LINE VERIFICATION PART II 


WRITTEN BY PHANTOM PHREAKER 


This file is meant to be an addition to the first file that was included 
in Phrack Inc. Issue XI. It is assumed that the reader has read and understood 
the previous file. Most of this information will be taken from Bell System 
Publications so you don’t have to worry about it being incorrect. 


First off, I’d like to correct a minor error included in the first file. I 
use the format ’KP+0XX+PRE+SUFF+ST’ to show the MF routing that is used. This 
is not correct AT&T syntax though, the correct format is KP+0XX+NXX+XXXX+ST. 


This is minor detail, but some people are very picky. 


[The Verification Network 


In a TSPS office, a verification circuit is associated with a 4-wire 
OutGoing Trunk (OGT) and a 3-way/4-wire bridging repeater arrangement. This is 
the circuit that does the speech scrambling. The speech and other tones (like 
busy and re-order) are frequency shifted, but are still recognizable by a TSPS 
operator. 


TSPS verification trunks are connected via dedicated lines to incoming 
verification trunks in a toll office. The toll office provides either a link 
to an outgoing trunk and dedicated facilities to another toll office, or an 
outgoing toll connecting trunk and dedicated facilities to an incoming 
verification trunk in a local office. Each toll office has ways to check the 
security of verification trunks. In electronic toll offices (ESS offices), two 
independent office data translations provide security of the trunk. Electro- 
mechanical toll offices (Such as a CrossBar Tandem (XBT)) use an electrical 
cross-office check signal or a segregated switching train to control trunk 
connections. Verification trunks relay supervisory signals (such as answering 
supervision) to TSPS from the line being verified. Also, if verification 
trunks are busy, the TSPS operator will receive a re-order. 


The functions of the VFY key 


When the operator presses the VFY key, several checks are made upon the 
number that has been entered. These ar 

A Check to see if the line is within the verification network accessible 
by that particular TSPS. If the line is not, the VFY key will flash. 


A check to see if the owner of the line wishes BLV to be possible or not. 
If the line is something like a police emergency line, then the VFY key will 
flash, similar to the first check. 


Important TSPS keys 


When the VFY lamp lights steady (doesn’t flash), indicating the process is 
acceptable, the operator puts the calling customer on hold and accesses an 
idle loop on the operator position. The ACS (Access) lamp lights steady if a 
verification trunk is available at that time. Then, the operator presses the 
ST key which sends out the complete number to be verified, in MF. The 
verification circuit activates, and the operator listens for scrambled speech 
and also watches the CLD (Called) lamp on her console. The CLD lamp is lighted 
when the operator loop was accessed, and will remain lit if the line being 
verified is on-hook. The operator has two ways of seeing if the line is in 
use, by listening, and by watching the CLD lamp. If the CLD lamp light goes 
out, then the line is off—-hook. 
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station-to-station completed collect calls. 


Maintenance and traffic measurements 


[These reports can be output from a maintenance or engineering and service 
data TTY, daily or hourly. Each daily report contains data for the previous 
day. Some traffic counts are as follows: 
Total Verification attempts, VFY key depressions, VFY key depressions when 
the requested number is out of TSPS range, VFY key depressions in which the 
requested number wasn’t verifiable, BLV trunk seizures which pass an 
operational test, and EMER INT attempts. Other traffic counts include the 
measurements for usage of BLV trunks, the amount of time BLV trunks were 
unavailable, and the number of times BLV trunks were seized. 


I hope this file has helped people further understand how the BLV system 
works. If you haven’t read part I, get a copy of Phrack Inc. Issue XI and read 
file #10. 


As said earlier, most of this information comes directly from Bell System 
Publications and so it should be viewed as correct. However, if you do find 


any errors then please try to let me know about them so they can be corrected. 


Suggested reading 


TSPS Part I: The console-Written by The Marauder, LOD/H Technical Journal 
Issue No. 1, file #4 


Busy Line Verification-Phrack Issue XI, file #10 
Busy Verification Conference Circuit-Written by 414 Wizard 
Verification-TAP issue 88, Written by Fred Steinbeck 
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==Phrack Inc.== 
Volume Two, Issue 12, Phile #9 of 11 


Rebuttal to Phrack Issue 8 and 11 (File 11) 
Written by Scan Man..... 


It has been requested of Taran King (Who doesn’t agree with KL on this subj) 
to put this somewhere in the next issue of Phrack (12) for proper 
distribution. Whether he does or not I cannot say. 


Well a number of months have gone by now and I have been written about 
accused of and had rebuttals written for me, all of which were about as clear 
and factual as mud. And that includes the rebuttal that Telecomputist has in 
effect tried to stand with me, and making matters only worse by inaccurate 
information. But then all of this started with inaccurate information from 
PWN, didn’t it. KL has resorted to interfering in other peoples lives in order 
to promote his so called news publication. To this I say, if you are going to 
call it news then make it facts. I can buy the Enquirer if I want sensational- 
istic readership boosting and inflated gossip. You do no justice to yourself 
or your publication. I really shouldn’t dignify any of this with comment but 
shall as th ntire matter has been blown so far out of proportion and since I 
have been phreaking since these kiddies were still messing their diapers I 
feel it a little more than an inconvenience, particularly since these 
gentlemen (and I use the term loosely) can’t seem to accomplish anything but 
guesswork and conjecture and have cost me (and my wife and son) a $50,000 job 
so the least I can do is get a few FACTS out. 


First, I was (and I stress was) employed by a company called Telecom 
Management Corporation. Notice the initials of this company (TMC). Telecom 
Mgnt is a management company, and a management company manages other 
companies. Among the companies it manages are 6 TMC Long Distance markets 
(none of which are in Vegas), two of which are in Charleston where I live and 
NY where I worked (up until two snotty nose teenagers (KL & SR) decided to 
stick there nose where didn’t belong). At any rate I was hired and paid by 
Miami, lived in Charleston, and worked in NY. And yes with regard to your "he 
must have been quite an asset to them," I was an asset to them. And KL you 
seem to think it was surprising that they flew me to NY every week. I don’t, 
and I’m sure the other 100 businessmen on my flights who I traveled with 
regularly would be surprised that they carried the unique distinction of being 
somehow in the wrong for having their companies send them to NY every week. 
I’1ll have to tell them this one for a good laff next time I get a 50,000 
dollar a yr job that sends me to NY. Moving right along, I will add that I was 
employed as a Systems Analyst. When I was originally hired, my interview was 
by a fellow from Miami (Telecom Mgnt) and the interview was conducted in the 
Chas office (one of the few times I was ever in there). This however doesn’t 
explain why Pauline Frazier and Ben Graves knew me or didn’t care for me. The 
reason for this was quite simple: they both knew about me and the bulletin 
board and had also been trying to catch me stealing calls from there company 
(don’t know where they ever got that idea <grin>). At any rate they obviously 
were quite unhappy because I got that job. 


The next comment in rebut to Telecomputist which was a rebut to PWN Phrack 
Issue 8 (what a nightmare), was, and I quote, "I claimed not to have any ties 
with Vegas but didn’t claim not to have ties with TMC." Boy talk about factual 
journalism, really grabbing for straws aren’t you. Anything to make me look 
bad huh? Wonder why. Wouldn’t be for more copies for your next issue would it? 
As you could see at the beginning of this rebuttal I clearly stated that 
Telecom Management ran 6 TMC markets as well as other companies and that they 
were connected but separate from each other. Although none of it is relevant 
to any of this, but that doesn’t matter when you are out to get copies for 
your next issue does it KL. At any rate this also shows where Telecomputist, 
although trying to do a good thing, got their facts mixed up too by 
misunderstanding the fact that Telecom Managements initials were the same as 
TMC and were unrelated companies when actually they are. 


In you next comments you say, "The rest of my statements are highly debatable" 
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(might try looking at a few (no make that all) of your own). You also said 
that my statements have no proof (as if yours are so damn factual). First, I 
don’t have to prove a thing to assholes like you or anyone else for that 
matter. You also state your decision (as if you have the right to make any 
decisions about me, (shit boy you don’t even know me, but you may soon) was to 
do nothing because of lack of proof. And you call what you came up with truth? 
Based on what, your vast personal knowledge of me, your knowledge of something 
some phone phreak told you, because of having worked with me? As for providing 
more ammunition to the idea, I’m not what I claim to be. I have claimed to be 
nothing, it’s you doing all the claiming. And there is no "ammunition" to be 
had from the Telecomputist article as it was about as accurate as yours have 
been. Shows you what two people who know nothing about nothing can do if they 
put their minds to it. I might add that this is the first and last statement I 
have personally written that has anything to do with any of this. You also 
stated that, "after three months you had proof," yet you have shown only 
words, not a speck of proof or truth. You have taken the Telecomputist article 
apart and tried every way there was to tear it apart, most of which was 
guesswork and innuendo. Examples of this are your quotes of, "Gee isn’t that 
awful expensive," "Notice how he didn’t say he had no ties with TMC," 
"Statements were highly debatable," "Now that he has had a few months to come 
up with a story," etc., that’s some real facts there KL, you’re a real 
journalist who deals only with facts. You’re not out for gossip or character 
assassination. Riiiiiight. I’ve just been waiting for you to put your foot in 
your mouth (in this case both feet). (Don’t worry, I’m sure they will fit 
nicely) 


I think it’s also time to tell the story of how all this got started. It’s 
really a comedy of errors (only I’m not laffing). As I stated earlier I was 
paid by Miami, as that’s where the home office was. This meant that on 
occasion I also went to Miami as well as NY. In Dec of 85 I learned of a new 
organization being formed called the CFCA (Communications Fraud Control 
Association) although in addition to communications, they support computer and 
credit security as well. Knowing that all the top security people were going 
to be there and being a good phone phreak on the eternal quest for inside 
knowledge, I wanted in on this conference which was held the 6th, 7th and 8th 
of Feb 86 in Miami. Soooooo I convinced Telecom that we should check these 
People out for some benefit to our company with regard to my job (Systems 
Analyst) as after all it was my job to not only develop and operate the 
companies’ computers but keep them secure as well. So I had had the perfect 
xcuse to get me in the conference. They agreed with me and went for it and 
paid for my flight down there and the conference fee. Moving right along, it 
was the lst day into the conference when just at lunch I was talking to a guy 
from Pac NW Bell named Larry Algard (whose name I had forgotten til Sally Ride 
showed up on the BBS saying Larry the Algardian had sent me a couple of weeks 
later). At any rate while talking to this guy, a security agent from one of 
the other LD companies that was there came up and said, "Aren’t you Scan Man, 
the guy that runs P-80?" Needless to say I about shit, and had to come up with 
a damn good answer in about a 100th of a second. Knowing I was there legally 
with the authority of my company, I answered back (in front of Larry Algard), 
"Yes, but unbeknownst to my members it’s an undercover board for TMC the 
company I work for." And since Telecom Management Corporations initials were 
TMC and they did manage 6 TMC LD companies I knew I was safe if he decided to 
check me out, which I was worried about becaus arlier this same guy (the one 
that said, "Aren’t you Scan Man") had made a comment about the security of the 
meeting and that he believed hackers had infiltrated the meeting. At any rate, 
I was out of the fire with this guy and everyone (about 7 others) standing 
around in our circle. It does however get worse. Two weeks later I got a new 
user on the board named Sally Ride saying, "Larry The Algardian sent me" and 
the msg subj was titled Scott Higginbotham. I answered the msg asking him 
where he got that name (Scott Higginbotham, my real name) but he thought I 
meant where did he get the name Larry the Algardian (see msg reprint below). 
His reply is as follows (actual copy of msg) 


Scan Man, I got the name from an electronic memo from Sec. Mgr. Larry Algard 
to his boss, George Reay. Since I’ve access to these files via PNB’s UNIX AOS, 
I read about Algard’s meeting with Scott at a CFCA Conf. in Miami. It’s nice 
to be able to know what the other side is up to, but how did you infiltrate 
CFCA? I was able to infiltrate PNB Sec. thru their own system. But, to attend 
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such a meeting of the toll carriers of the nation and learn their plans to 
combat us is a real coup! Understand where I’m coming from? 
Sally Ride:::Space Cadet 


Now from this msg you can see two things: first that Sally Ride is a two faced 
little S.O.B., plus you can also see why he would think I was fed. I can 
almost (again I stress almost) understand why he was suspicious. This msg also 
points out that at least in his msgs to me he was of the opinion that I had 
infiltrated the conference (not that his opinion about anything matters). 
Then, on a social ladder climbing binge, he turns it around to me being one of 
them (as if he was the only person in the world who could infiltrate 
something). To this I say again, I was doing this when you were still in 
diapers (SR). Even though I can legitimately understand why he would think I 
was a fed as this at least "APPEARS" to be proof that I’m a fed, by that I 
mean if I had broken into a telco security computer and found a msg saying 
that so and so was running a sting board, I would be prone to believe it 
myself. What Sally didn’t know was that I had to say that at that conference 
to keep from being fried myself when confronted by a security agent who 
recognized me. But then what are the odds of someone breaking into the very 
computer reading that very msg. If it were me and I was going to take this 
information to the phreak community I would have to state the facts, which 
were that he found this msg, "then print msg". I would not go into the 
guessing that he and KL did in the original Phrack article (or this last one, 
since the first obviously wasn’t enough). But back to the point of all of 
this, "WHAT WOULD YOU SAY STANDING IN THE MIDDLE OF 500 TOP TELCO SECURITY 
PEOPLE AND ONE WALKS UP AND SAYS, "AREN’T YOU SO AND SO THAT RUNS SO AND SO 
BBS?" See what I meant about a comedy of errors? Do you also see why 
sometimes what is apparently the truth isn’t always what it appears as. Do you 
also see what I mean about gossip and poor journalism? This is not the first 
time that Sally or KL has tried to distort facts and interfere with people’s 
lives. I am referring to the past David Lightman incident. Instead of 
belaboring this point, I shall, in the fashion of the great journalists (KL & 
SR), reprint another msg from Sally regarding this other incident in order to 
show what kind of individual we are dealing with (a 19 yr old who if he spent 
as much time hacking and phreaking as he does stretching the facts and butting 
into peoples lives might be a good phreak/hack). 


From: Sally Ride 


Well a couple of things..first about Phrack World News..the above mentioned 
article about Blade Runner and David Lightman was credited to David Lightman 
and Blade Runner and someone else, maybe K.L. I really don’t know either David 
or Blade that well, but when someone is accused of being a cop, or a phone 
cop, or whatever, I see no reason to keep that a secret from the phreak-world. 
Everyone is able to make their own conclusions based on the information 
provided and considering the sources. Finally, and I hope this ends all 
discussion about this on the "Elite" section of this BBS. Is that what is 
allowed for discussion here? Really, character assassination should be kept to 
the War Room of some other K-Rad luzer BBS. Secondly, thanks to all who kept 
me up to date on the status of the BBSes that had suddenly dropped out of 
sight all for separate unrelated reasons. I found The Twilight Zone, now the 
Septic Tank, it’s back at 203-572-0015, old accounts intact. Taran King’s 
Metal Shop Private should be back up within hours of this message, see PWN 6 
for the details. And Stronghold East is still down as far as I know, should be 
back around 7/1. Broadway’s always been weird but turning informant? Will 
wonders never cease? And, TUC has a board again? And, here I thought he was a 
"Security Consultant", per W.57th St. Who knows who’s side who is on? Scan 
Man, here’s news from your neck of the woods. A company named Advanced 
Information Management Inc. run by Robert Campbell. The June 23rd issue of 
Communications Week says this guy and his 17 consultants are all over the BBS 
world. They are based in Woodbridge, VA. Know anything about them? Sound like 
some more narcs to worry about. What is the true story on Ralph Meola? PWN 6 
says he’s the head of AT&T Security. Has anyone ever heard of him before? 
Sally Ride:::Space Cadet 


I believe your words were, "character assassinations should be kept on some 
k-rad Luzer war board" (try taking some of your own advice, or is it different 
when it’s your friend). You also made the statement that everyone should be 
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able to make their own decisions based on the sources. In my case it’s two 
guys that don’t know me or really anything about me (KL & SR). Did anyone also 
notice Sally’s tendency toward a persecution complex? Everyone he mentioned in 
the msg is thought to be a phone cop. I mean, really, take a good look at that 
msg. It’s quite obvious this boy is playing God and deciding who is and isn’t 
on who’s side (you’re not the only one who saves msgs). He’s either attacked 
or defended (mostly attacked or insinuated) about 5 people in one msg of being 
the bad ole phone cop. Who set you two up as judge and jury? As to how I feel 
about it, I’1l use an old saying with a new twist, "If you want to hear the 
jukebox, you damn well better have a quarter," better known as "pay the 
piper". Does it sound like I’m upset? I mean how would you feel if you had 
trouble keeping your family fed, heated, and housed because some asshole that 
just hit puberty stuck their nose into your life. Tell your son, no he can’t 
go skating because you don’t have the money because........ etc..... Also I 
might add that a number of us old guards who were phreaking before there wer 
computers and BBSes such as my old friend, Joe Engressia (Secrets of Little 
Blue Box, Esquire 71) (avail P-80) and others have done actual security work 
(not busting heads) defeating security systems on new payphones (test befor 
marketing) etc for yrs. I don’t see anyone jumping up and yelling phone cop on 
these guys. People who are admitted security people who also claim to be 
phreaks are ignored. So why all the stink with me? In closing I would like to 
say that I have little doubt that in their usual fashion KL and/or SR will 
attempt to go over every word I have typed looking for more SO CALLED FACTS. 
Any way you try to reword it will only be more twisting and supposition. Sooo 
be my guest. You will get no more comments from me. The next time either of 
you two hear from me, you better have your Quarter for the jukebox cause it 
will be time to pay the piper. 


P.S. KL do me a favor and call my board and let me know whether you will be at 
this phreak conf in St Louis. If so I recommend old cloths, and clean 
underwear. 


(Oh yes and a quarter.) 


Scan Man (3-10-87) 
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Local News March 20, 1987 


This issue of PWN marks the anniversary of Metal Shop Brewery. 


Things are looking up. Metal Shop Private is back and all previous members 
are asked to call back. The same passwords and logons still work and even 
better, the old posts have been saved despite the hard drive crash a few 
months ago. 


Phrack XIII will be released on April 1, 1987; April Fool’s Day! 


It features joke files, fiction files, humorous files, and of course, rag 
files. With all the seriousness of the regular issues of Phrack, this is a 
chance to release some building flashes of comedy. Please note that files for 
Phrack XIII can only be submitted by members of Metal Shop Private. This does 
not apply to other issues of Phrack. Don’t miss it! 


SummerCon 1987 
For those that don’t already know, TeleComputist Newsletter and Phrack Inc. 
are sponsoring this year’s big phreak gathering in St. Louis, Missouri. As 
many of you may note, St. Louis is the home of Metal Shop Private, Phrack 
Inc., and TeleComputist Newsletter. We all hope that since St. Louis is in 
the middle of the country that it will be easy for people to attend. We 
extend an invitation to anyone who wants to come. We will have a conference 
room and two suites in a hotel in St. Louis. 


The official date for SummerCon 1987 is June 19,20. This is far enough into 
the summer that everyone of the younger generation should be out of school and 
early enough that no one has to worry about facing reality right away. This 
date has also been chosen specifically as to not interfere with the St. Louis 
VP Fair (Vale Profit). 


If you are going to attend SummerCon, we ask that you contact Knight 
Lightning, Taran King, or Forest Ranger for more details. The TeleComputist 
Information Line is (314) 921-7938. The names of those attending will be kept 
confidential so as to not cause anyone discomfort, however we do ask that you 
identify yourself at the conference by means of a name tag or some form of 
identification. Security personal is welcome to attend, but we request that 
you let us know ahead of time. If anyone, especially security personnel, 
would like to speak at SummerCon please also let us know and we will schedule 
you in. 


:Knight Lightning 


Hackers Caught Using Credit Card To Buy More Equipment February 20, 1987 


By Ben L. Kaufman of The Cincinnati Enquirer 


"I was uneasy about the pickup." 


Two young "hackers" in Milford using an electronic bulletin board to get 
stolen credit card numbers and buy hardware to expand their computers. Now 
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they’re in big trouble because unauthorized use of a credit card is a federal 
offense and the Secret Service caught them. "Computer-aided credit card fraud 
is increasingly common, said special agent in charge, James T. Christian on 
Tuesday, "but using the filched name and number to enhance computer clout was 
a unique touch." 


The two youths had a $1,300 order sent to an abandoned house on Ohio 131E, 
Christian said, but when they picked it up an agent was waiting with the UPS 
deliveryman. 


John Martin Howard, 21, 5788 Meadowview Drive, Milford was cited before U.S. 
magistrate J. Vincent Aug Jr., who accepted his plead to guilty Monday and 
released him on his promise to return when summoned. 


"I was uneasy about the pickup," Howard recalled in a telephone interview. Th 
risk of getting caught "was in the back of my mind." And it was an awful 
moment when the Secret Service agent confronted him and his juvenile buddy, 
Howard added. "I think they were surprised," Christian said. Howard was 
charged with attempted use of an unauthorized credit card. His juvenile 
partner -- who refused to comment Tuesday was turned over to his parents. 


Christian said the youths ordered equipment from Computer-Ability in suburban 
Milwaukee paying with the stolen credit card. A sharp-eyed store employee 

noted purchases on that credit card were coming in from all over the country 
and called the Secret Service. Within two weeks the trap in Milford was set. 


Howard said his young friend knew the Cincinnatian who led them to the 
bulletin board filled with the names and the numbers of stolen credit cards. 
"We got it from somebody who got it from somebody who got it from somebody on 
the east coast," Howard recalled. That new acquaintance also boasted of using 
stolen card numbers from electronic bulletin boards to buy expensive 
accessories and reselling them locally at bargain process. 


He and his friend used the stolen credit card to upgrade his Atari 800 system, 


Howard said. "We ordered a bunch of hardware to use with it." In addition to 
the purchase that drew the secret service to them, Howard said they "ordered 
other stuff, but before we received anything, we were picked up." Howard said 


he’d had the Atari about two years and was getting bored with it and home 
computers in general. 


He had taken computer programming for eight months after high school, he said, 
but hadn’t used it. He would like to try computer-aided design and 
engineering, but right now, he’s working in a pizza parlor. Christian said 
Howard’s parents had been enthusiastic about his computer interests and 
friends who shared them. "They though it would keep them out of trouble." 


Assistant U.S. attorney Kathleen Brinkman and Christian said the Cincinnati 
area investigation was continuing and numerous juveniles, some quite young, 
may be involved. 


Thanks to Grey Elf 


Re-typed for PWN into lowercase by Knight Lightning 


Hang On... Phone Rates Are Falling Again! March 1987 


>From Changing Times Magazine March 1987 Issue 


No news that long-distance rates are still headed down, but now local rates 
are poised to follow, at least in some areas. 


Competing long-distance carriers have already been forced to react to AT&T’s 
January rate cut, which averaged 11.2%, with cuts of their own. Now the 
Federal Communications Commission [FCC] may propose that an additional $1 or 
$2 be added to the subscribers line charge, the $2-a-month access charge that 
every residential customer pays. If that happens it would compensate. 


Since AT&T’s divestiture in January 1984, the telephone services component of 
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the consumer price index has risen 17.4%, reflecting a 36.7% increase in local 
rates at the same time long-distance charges were falling. But price 
increases for overall service have moderated each year, falling 2.7% in 1986 
from 4.7% in 1985 and 9.2% in 1984. That trend should continue as local rates 
stabilize and even fall. Wisconsin and Vermont, for example, have ordered 
local companies to make refunds, and a number of states - New York, 
Pennsylvania, Washington - are considering lowering rates to reflect the 
improved financial position of local phone companies. Those companies will 
benefit from tax reform, and lower inflation and interest rates have resulted 
in lower expenses in several other areas. 


Things are not looking good for some of AT&T’s competitors in the long 
distance business, however. Forced to follow AT&T’s rate cuts, both MCI and 
US Sprint are hard-pressed financially, and analysts don’t rule out the 
possibility that one or both could get out of the long-distance business, 
potentially leaving AT&T a monopoly again. But that would be "politically 
unacceptable," says analyst Charles Nichols of E.F. Hutton. Some 
alternatives: allowing regional phone companies to enter the long-distance 
business or allowing AT&T to keep more of the profits it earns from increased 
efficiency instead of forcing the company to cut rates. That would take some 
pressure off competitors. 


Special Thanks to Stingray 


Police Arrest Computer "Hacker" Suspect March 15, 1987 


>From the St. Louis Post-Dispatch 

"MCI told police it was losing $2.7 million a month to such ‘’hackers.’" 
A computer software engineer [Robert Wong] has been arrested at his home in 
Maryland Heights, Missouri on suspicion of trying to get into the computer 


system of MCI Telecommunications Corporation. 


The case is the fourth in this area involving computer "hackers" who have 
tried in recent months to get into MCI’s computer system, police say. 


Detective John Wachter of the Maryland Heights Police Department said the 
department would seek a warrant today charging the suspect with "tampering 
with computer users," a felony. 

The charge is being sought under a state law enacted last year to deal with 
hackers -— people who try illegally to tap into other computer systems. 


The suspect is Robert Wong, 23, of the 2000 block of Maverick Drive, Maryland 
Heights, Missouri. Police tracked down Wong by a court-sanctioned "trap" on 
his phone after MCI learned that someone was trying to tap into its 
long-distance lines. 


In a written statement to police, Wong said he "came across" MCI’s programs 
and access codes. He said he was "amazed" when he got into the system. "I 
know it was illegal, but the urge of experimenting was too great," he told 
police. 


Typed For PWN by Taran King 


PWN Quicknotes 

In upcoming months P-80 will be moved from her ole TRS Model 1 to an IBM PC 
compatible. In addition to a boost in storage capacity (amount still 
undecided), P-80 will be adding a new "user to user" direct file/program 
transfer thus allowing the membership the ability to privately send text or 
programs directly to another user. There will also be the ability to forward 
a message with text/program attached) to another user after receipt. (2/26/87) 


Information from 
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<S><C><A><N> <M><A><N> & P-80 Information Systems 


If you consider yourself a phreaker or a hacker in any way, shape or form, 
then read on! The Telecom Security Group is sponsoring the first on-line 
hack/phreak survey. It consists of about 30 minutes work of answering 
questions (or until you want to stop) that pertain to phreaking, hacking, the 
security, and the attitudes surrounding it all. 


You are allowed to identify yourself during the survey if you wish or you may 
remain totally anonymous. It’s really just the general answers that will 
count. Call now: 914-564-6648 (914-LOG-ON-IT) and type SURVEY at the main 
prompt to get the survey. Thanks for your involvement, and do spread the word 
to any board that considers itself phreak/hack oriented. 


Information by Taran King & Tuc (2/6/87) 


Telecommunications giant AT&T is lying in its advertisements that claim it has 
an exclusive toll-fr number for foreign clients to reach U.S. businesses, 
its competitor says in a lawsuit. 


Worldwide 800 Services Inc. says that it has filed suit against AT&T with the 
FCC, charging AT&T with false advertising. The ads by AT&T claim that it can 
provide a global telephone network that would allow clients in foreign 
countries to call a toll-free number to reach businesses in the United States. 
AT&T claimed that "You won’t find this type of service anywhere else." 


Worldwide 800 says that their company provides toll-fr service from any 
foreign city to the U.S., whereas AT&T can only provide toll-fr service ona 
countrywide basis. An AT&T spokeswoman denied all of the charges, stating 
that the advertisement in question was neither fraudulent or deceptive. If 
Worldwide 800 Services wins the case, they state that they will demand 
corrective advertising and seek monetary damages. 


Information from Lucifer 666 (3/1/87) 
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Toll-Free Woes January 26, 1987 


Time Magazine; reprinted in the February 1987 Issue of CO Magazine 


While Oral Roberts struggles with budgets, fundamentalist preacher Jerry 
Falwell faces a different kind of money pinch. The Lynchburg, VA, 
televangelist has long used toll-fr phone numbers to assist viewers seeking 
spiritual help. 


For many months Falwell foes, aware that each phone-in cost $1, have purposely 
clogged his lines. An Atlantan programmed his computer to dial Falwell every 
30 seconds. Before Southern Bell stepped in, the stunt cost Falwell $750,000. 


Late last year, the Daily Cardinal student newspaper at the University of 
Wisconsin -—- Madison ran a column advocating "telephone terrorism" and listed 
several targets, including Falwell. 


[The TV preacher estimates that annoyance calls cost him more than $1 million 
last year, not counting lost donations. Falwell, who is considering legal 
action, regards the calls as "unlawful activities" that do "injury to the 
cause of Christ." 


[Well now...isn’t that special? And just where did all these people get th 


idea to do "injury to the cause of Christ?" From me, Knight Lightning? No, I 
don’t think so. From oh maybe Phantom Phreaker? No, I don’t think so. 
Possibly Lucifer 666, but the big question is... Could it be... SATAN! !!?] 


Typed For PWN by Knight Lightning 


Voice numbers: Are They Really Necessary? March 5, 1987 
A recent series of events on ShadowSpawn BBS has attracted much attention in 
the hack/phreak community. It seems that the sysop, The Psychic Warlord, 
denied access to Lex Luthor, Kerrang Khan, and Silver Spy because of their 
failure to leave valid voice phone numbers. The following messages have been 
taken from ShadowSpawn BBS. [Some posts have been re-formatted]. 


32/50: This board... 
Name: The Psychic Warlord #1 
Date: 6:36 pm Thu Feb 26, 1987 


Alright goddamn it, I’m so fucking pissed off that I’m just about ready to 
say Fuck It and take down the board for good. Why? Seems that few people ar 
happy with the way I run this board. No, not really with the way I run it, 
but more like the way I choose to validate my users. Ok, fine... You don’t 
like it then get the fuck out and quit complaining. 


I set certain rules that people have to abide by to get access to this 
board. Very simple fucking rules. And now I’m finding out that people don’t 
want to abide by these rules, and basically tell me I’m fucked in the head for 
having and going by them. What rules? For one thing, and this is the major 
bitch-point here, new users (no matter WHO THE FUCK they are) are *REQUIRED* 
to leave a valid voice number where I or Ctrl can reach them at for 
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validation. No big fucking deal... Just a goddamn phone number. 
"Oh, but I can’t give you my voice number. I’m a hacker, and I do untold 
amounts of illegal things and I can’t risk my number getting out." Riiight. 


Like I’m really some fucking Fed who’s gonna bust yer ass, or some geek who 
gives out peoples phone numbers to any-fucking-body who asks. BULLSHIT! 


I’m the Sysop of a (hopefully) respected BBS, and along with that goes a 


certain responsibility. I’m not about to go passing out peoples numbers. *I* 
have respect for other hackers privacy, unlike some people who choose to 
invade mine just for the fucking hell of it. I require that new users leav 


their voice numbers for a number of GOOD reasons: 


1) Trust -- If they can trust me with their voice numbers, then I can trust 
them with access to my board. I need that kind of trust between 
me and my users. If they feel that they can’t trust me enough to 


give me a lousy phone number, then how in God’s name am I supposed 
to be expected to trust them at all?? My ass is on the line just 
as much (if not more) than any user of this board! 


2) Security -- Ok... So how do I know if someone is really a Fed or not? I 
don’t! I go by instinct. Having a person’s voice number let’s 
me call them for validation and get to know them a helluva lot 
better than I could through e-mail. Plus, if suspicion ever 
arose about a user of my board being a Fed or not, how could I 
check this out? If I don’t have their voice number, I have no 
leads as to where to find or who the fuck this person really 
is. Now I don’t go checking everyone on the board via the 
numbers they give me. I have NEVER had to do that for ANY 
user, but the possibility is there. And rather than throw a 
possibly innocent person off the board merely on a hunch, we 


might be able to prove whether or not it’s true. This is 
extremely hypothetical, but like I said... the possibility is 
there. 


Ok, so why the hell should I have to require that established people, lik 
Lex Luthor and Silver Spy, leave valid voice numbers? Is it fair to the other 
users? Hell no. If I required only certain people to give me their numbers, 
then what does that do to their trust in me?? It’s like me saying, "Well, I 
don’t trust you... I don’t know you that well. You have to sacrifice more 
than these guys to get access." That’s BULLSHIT, and I’m not about to do it. 
If one person is required to give a valid voice number, then every damn user 
is required to! 


I’ve been getting a lot of shit the past couple days because I’ve denied 
access to some very well known and respected people in the hack/phreak world. 


Namely Lex Luthor, Silver Spy, and Kerrang Khan. I denied all of them access 
because they all refused to leave a voice number. Fine. Then they don’t get 
access. Ctrl [Ctrl-C is a cosysop on ShadowSpawn] said I was crazy. Taran 


said pretty much the same. Taran also tried to get me to change my mind... 

to condescend, or go against what I believe in and how I believe this board 

should be run. He (Taran) said that by my denying Lex and the others access 
that I would be hurting this board more than helping it. ***I DON’T GIVE A 

DAMN** * 


I’m not impressed in the least with any of those peoples reputations. I 
never have been a "groupie" and I’m not about to start now. Whether or not 
they are good or not isn’t the issue here, and some people don’t seem to 
realize that. Yes, Lex is good. He’s well known. He’s even a nice guy... 
I’ve talked to him before and personally I like him. But I don’t play 
favorites for anyone. Not Lex, not Silver Spy, and not Kerrang Khan. Nobody. 


What really pissed me off, and I should have told Taran that I resented it 
at the time, is that TK said that apparently this board is "elite". That I 
consider this board to be too good. Personally I think this fucking board is 
overrated, and yes Taran... I resented that remark. I can’t remember exactly 
what he said, but it was something like, "In your logon message you have 


= 


'We’re not ELITE, we’re just cool as hell,’ but apparently you ARE elite." 
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This board isn’t "elite" and if I come off seeing that way sometimes, it’s 
only because people are getting half the picture of what I’m doing. 


Ok, so I deny Lex Luthor access to this board. That’s all you people seem 
to think about. The actual denying of access. You think, "How can he do 
that?! What gall! He must be a real egotistic bastard to think that Lex 
Luthor isn’t good enough to be on this board!" If you think that, and most of 
you have thought only that, then you’re fucked in the head. 


Yes, I realize who thes 
they are renowned for their 
said before, that’s not the 
people are. I *KNOW* about 
don’t care. That’s not why 


ople are! Yes I know their reputations and how 
kills as hackers and phreakers... But like I 
ssue. It never was. I *KNOW* how good these 
heir reputations and I respect them for it, but I 
hey’ ve been denied access! 


tthe as 


When I deny someone access to this board it’s usually for one of two 
reasons; 


1) They left a false voice number or 
2) They either blew off or left really crappy answers to the filter. 


Personally I’d be thrilled to have Lex or Silver Spy on the board... and 
any of a number of people. But these people can’t find it in themselves to 
trust me. If they can’t trust me, then I can’t trust them. It’s as simple as 
that. 


I’m not about to let anyone on this board that I can’t trust. It’s not 
fair to the other users, and it’s damn stupid of me. I run this board the 
best way I know how. I do what I do in respect to new user validations 
because it’s the best way, through trial and error, that I have found to 
handle it. If people can’t respect the way in which I choose to run my board 
then I’d appreciate it if they never called. And when regular users of my 
board start questioning the way I do thing, and telling me that I’m WRONG for 
doing things the way I believe they should be done, then I really start to 
wonder what the fuck I’m doing it for at all. I’m not a quitter, and I don’t 
like the idea of giving up and taking down the board. I’m going to run this 
board the way I think is best, and I’m not about to conform to what other 
people think I should do. 


I’ve probably stepped on some toes and offended some people with this, but 
that’s just too damn bad. I hate fighting the topic but I’1l fight it if I 
have to. 


--==The Psychic Warlord==—-— 


37/50: Take a fucking valium 
Name: Taran King #45 
Date: 9:02 am Sat Feb 28, 1987 


You’re known for an explosive temper, PW as well as sometimes being extremely 
irrational. My policy is to let people on the my board with voice numbers 
only. Through the history, I’ve made maybe 5 exceptions. Some of ’em include 
Lex, Spy (at first), Tabas, Videosmith, and Phucked Agent 04. Now, I never 
got anything out of PAO4 because he got a "call" soon after he got on the 
board, but the rest of the members have contributed extremely well to the 
board. I just made sure I knew it was really them by referencing and cross 
referencing. 


If your morals are that unbendable, PW, then you need to relook at the purpose 
of this board. If it’s to spread phreak/hack knowledge as you said on the 
phone, then to have those people on with the experience that they have would 
hardly hinder the board. I seriously doubt anyone would feel offended if any 
of the forementioned people got on here without leaving a valid voice number, 
being that they’re not on any other board with a voice number. 


I know that Lex is not giving out his number to even the best of his 
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friends. Spy is really careful about it these days. Not so sure about 
Kerrang but he’s travelling about now so he’s not in one place for too long 
nowadays. It’s your board and I was trying to give you some constructive 
criticism, but you took it the wrong way. You don’t have to claim you’re 
ELITE to be elite. Elite merely means that you’ve got the respected members 
of the community on board. Well, you’ve got ’em. If you don’t like it, I 
suggest you go through and purge the log like a big dog. Actually, fuck it. 
I’m tired of getting into arguments for trying to help someone. Feel fr to 
delete my account if you feel that I’ve not contributed enough information to 
the board, or if you’ve rethought the purpose and decide that it’s not for 
what I’ve contributed, dump me. Fuck dis 

-TK 


44/50: Well... 
Name: The Psychic Warlord #1 
Date: 4:57 pm Sun Mar O01, 1987 


I’m glad that some people agr with me on this. I can understand Lex’s 
point of view, too. I can also remember a time when I myself refrained from 
giving my number to any sysops. But... I’ve changed my point of view 
considerably after living the Sysop life for well over 1.5 years. Now if I 
ever wanted access to a board, and the Sysop of that board asked for my voice 
number, I’d give it to him. 


I’ve given Lex access to this message base for a short period of time so 
that he can check out the discussion. He called me voice the other day and we 
talked for a while about this whole biz. I’d like him, and Spy, on the board, 
and possibly they’1ll change their minds. If not, that’s cool. I’m just going 
to let the whole thing kind of slide from here on out. If they change their 
minds, great... Well, Adios. 


—-==The Psychic Warlord==—--— 


Kerrang Khan, when notified that he must leave a voice number, said "there is 
no reason Psychic Warlord would need any user’s phone number." He also stated 
that the fact that PW insisted on voice numbers was very "Suspicious." 


Silver Spy, when notified that he must leave a voice number, never bothered 
calling again. 


Lex understood the whole situation and remained cool. He said he could see 
why a sysop would need voice numbers of his users. Lex was worried about the 
board he left it on getting busted and the authorities getting his number. So 
PW, in response to this deleted all users phone numbers from the board and 
encrypted them in a hidden sub-directory. Now the numbers are there only and 
are totally hidden. 


Information Provided By 


Lucifer 666/Psychic Warlord/ShadowSpawn BBS/Taran King 


